The standard recipe (matches LXC 119/120 builds).
# 1. Create — pick next VMID and IP from /reference/ip-plan
pct create <VMID> cephfs:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst \
--hostname <Name> --unprivileged 1 --features nesting=1,keyctl=1 \
--cores 2 --memory 2048 --swap 1024 \
--rootfs ceph-storage:10 \
--net0 name=eth0,bridge=vmbr0,ip=192.168.86.<X>/24,gw=192.168.86.1 \
--nameserver "192.168.86.1 8.8.8.8" \
--onboot 1 --tags <tags>
# 2. Persistent data on cephfs (if the service keeps state)
mkdir -p /mnt/pve/cephfs/<service>
pct set <VMID> -mp0 /mnt/pve/cephfs/<service>,mp=/opt/<service>,shared=1
# files written from the HOST need: chown -R 100000:100000 /mnt/pve/cephfs/<service>
# 3. Tailscale TUN (only if tailscale goes inside)
cat >> /etc/pve/lxc/<VMID>.conf << 'EOF'
lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
EOF
# 4. Base setup inside
pct start <VMID> && pct exec <VMID> -- bash -c '
ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime
apt update && apt install -y curl ca-certificates gnupg unattended-upgrades openssh-server
systemctl enable --now unattended-upgrades'
# 5. Docker CE (not distro docker.io)
# https://download.docker.com/linux/debian → docker-ce + compose plugin
# 6. Deploy: compose in /opt/<service>, secrets in .env (mode 600, generated)
# 7. Add Uptime Kuma monitor(s) + status page entry
# 8. Add to weekly vzdump job: vzdump job editor → include new VMID ← DON'T SKIP
# 9. Create /services/<name> wiki page from the template
# 10. Homepage entry
Checklist: ☐ static IP from plan ☐ unprivileged ☐ TZ set ☐ auto-updates on ☐ secrets generated not reused ☐ data on cephfs ☐ in backup job ☐ monitored ☐ documented.